Bug 2500967 (CVE-2026-42533)

Summary:	CVE-2026-42533 nginx: NGINX: Arbitrary code execution via crafted HTTP requests
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akito5623, ext.jakub.danek, gsciorti, kaycoth, klaas, rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the `map` directive uses regular expression (regex) matching and references regex capture variables before referencing the map output variable. This can lead to a heap buffer overflow, which may allow for arbitrary code execution on systems where Address Space Layout Randomization (ASLR) is disabled or bypassed. Additionally, this flaw can cause a denial-of-service (DoS) due to the NGINX worker process restarting.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-15 15:02:15 UTC

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.




 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Comment 4 Akiyoshi Kurita 2026-07-20 09:27:42 UTC

Additional information:

According to The Hacker News, the researcher plans to publish a PoC 21 days after the patch release, around August 5, 2026.

https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html

Comment 5 Klaas Weyermann 2026-07-20 14:08:44 UTC

https://access.redhat.com/security/cve/cve-2026-42533

It seems you rated this as "Moderate", because you changed the Confidentiality and Integrity Impact to "Low" from "High" -- for a RCE, is that correct?

Comment 6 Akiyoshi Kurita 2026-07-27 14:04:28 UTC

Additional information:

A public PoC/exploit was released on July 27, 2026, earlier than the previously announced August 5 date.

The repository demonstrates an unauthenticated nginx worker crash and claims a working pre-auth RCE chain on Ubuntu 24.04.

https://github.com/imbas007/cve-2026-42533

Comment 7 Akiyoshi Kurita 2026-07-29 11:37:20 UTC

Additional information:

A separate exploit implementation for CVE-2026-42533 has now been published by DepthFirst Disclosures.

Unlike the previously referenced HTTP/map-based repository, this PoC uses the stream ssl_preread script-engine path. It demonstrates command execution and a reverse shell in the supplied local Docker environment.

The exploit offsets are explicitly calibrated for the provided Docker image, so this should not be interpreted as a generally reliable exploit against arbitrary nginx deployments.

https://github.com/DepthFirstDisclosures/Nginx-Rift/tree/main/CVE-2026-42533